System and method for securing software applications and computing networks

Abstract

A method includes receiving an interaction to initiate an execution of a sequence of user interactions with at least one instance of a plurality of instances of a software application executing within a computing environment. The method includes executing one or more generative machine-learning models trained to generate a data structure configured to generatively present sequences of different information to a user in response to an execution of one or more user interactions. The data structure includes a generated decoy data. The method includes generating, based on the presented sequences of different information, one or more classification labels configured to associate with the user each of the presented sequences of different information and the execution of the one or more user interactions, and storing a log of the one or more classification labels, the presented sequences of different information, and the execution of the one or more user interactions.

1 . A system, comprising:
 a memory configured to store a plurality of instances of a software application executable within a computing environment and a generated decoy data; and   one or more processors operably coupled to the memory and configured to:
 receive an interaction to initiate an execution of a sequence of user interactions with at least one instance of the plurality of instances of the software application executing within the computing environment, and, in response:
 execute one or more generative machine-learning models trained to generate a data structure configured to generatively present sequences of different information to a user in response to an execution of one or more user interactions with the data structure, wherein the data structure comprises the generated decoy data; 
 generate, based on the presented sequences of different information, one or more classification labels configured to associate with the user each of the presented sequences of different information and the execution of the one or more user interactions; and 
 in response to determining at least a partial completion of the execution of the one or more user interactions with the data structure, store a log of the one or more classification labels, the presented sequences of different information, and the execution of the one or more user interactions. 
 
   
     
     
         2 . The system of  claim 1 , wherein the one or more processors are further configured to execute the one or more generative machine-learning models as further trained to generatively present the sequences of different information in response to the user performing one or more textual command interactions with the data structure. 
     
     
         3 . The system of  claim 1 , wherein the generated decoy data comprises one or more honeypots configured to prompt the user to complete the execution of the one or more user interactions with the data structure. 
     
     
         4 . The system of  claim 1 , wherein the data structure comprises one or more of a file path, a document content, a linked list, a stack, a queue, a graph, or a breadcrumb. 
     
     
         5 . The system of  claim 1 , wherein the one or more processors are further configured to:
 prior to receiving the interaction to initiate the execution of the sequence of user interactions with the at least one instance, train the one or more generative machine-learning models based at least in part on the plurality of instances of the software application executing within the computing environment and a network layout of the computing environment.   
     
     
         6 . The system of  claim 1 , wherein the one or more processors are further configured to:
 associate the one or more classification labels with one or more electronic files accessed by the user during the execution of the one or more user interactions with the data structure; and   update the log based at least in part on the one or more electronic files accessed by the user.   
     
     
         7 . The system of  claim 1 , wherein the one or more processors are further configured to:
 receive a second interaction to initiate an execution of a second sequence of user interactions with the at least one instance of the plurality of instances of the software application executing within the computing environment, and, in response:
 execute the one or more generative machine-learning models trained to generate a second data structure configured to generatively present second sequences of different information to a second user in response to an execution of one or more second user interactions with the second data structure, wherein the second data structure comprises a second generated decoy data; 
 generate, based on the presented second sequences of different information, one or more second classification labels configured to associate with the second user each of the presented second sequences of different information and the execution of the one or more second user interactions; and 
 in response to determining at least a partial completion of the execution of the one or more second user interactions with the second data structure, store a second log of the one or more second classification labels, the presented second sequences of different information, and the execution of the one or more second user interactions. 
   
     
     
         8 . A method, comprising:
 receiving an interaction to initiate an execution of a sequence of user interactions with at least one instance of a plurality of instances of a software application executing within a computing environment, and, in response:
 execute one or more generative machine-learning models trained to generate a data structure configured to generatively present sequences of different information to a user in response to an execution of one or more user interactions with the data structure, wherein the data structure comprises a generated decoy data; 
 generating, based on the presented sequences of different information, one or more classification labels configured to associate with the user each of the presented sequences of different information and the execution of the one or more user interactions; and 
 in response to determining at least a partial completion of the execution of the one or more user interactions with the data structure, storing a log of the one or more classification labels, the presented sequences of different information, and the execution of the one or more user interactions. 
   
     
     
         9 . The method of  claim 8 , further comprising executing the one or more generative machine-learning models further trained to generatively present the sequences of different information in response to the user performing one or more textual command interactions with the data structure. 
     
     
         10 . The method of  claim 8 , wherein the generated decoy data comprises one or more honeypots configured to prompt the user to complete the execution of the one or more user interactions with the data structure. 
     
     
         11 . The method of  claim 8 , wherein the data structure comprises one or more of a file path, a document content, a linked list, a stack, a queue, a graph, or a breadcrumb. 
     
     
         12 . The method of  claim 8 , further comprising:
 prior to receiving the interaction to initiate the execution of the sequence of user interactions with the at least one instance, training the one or more generative machine-learning models based at least in part on the plurality of instances of the software application executing within the computing environment and a network layout of the computing environment.   
     
     
         13 . The method of  claim 8 , further comprising:
 associating the one or more classification labels to one or more electronic files accessed by the user during the execution of the one or more user interactions with the data structure; and   updating the log based at least in part on the one or more electronic files accessed by the user.   
     
     
         14 . The method of  claim 8 , further comprising:
 receiving a second interaction to initiate an execution of a second sequence of user interactions with the at least one instance of the plurality of instances of the software application executing within the computing environment, and, in response:
 executing the one or more generative machine-learning models trained to generate a second data structure configured to generatively present second sequences of different information to a second user in response to an execution of one or more second user interactions with the second data structure, wherein the second data structure comprises a second generated decoy data; 
 generating, based on the presented second sequences of different information, one or more second classification labels configured to associate with the second user each of the presented second sequences of different information and the execution of the one or more second user interactions; and 
 in response to determining at least a partial completion of the execution of the one or more second user interactions with the second data structure, store a second log of the one or more second classification labels, the presented second sequences of different information, and the execution of the one or more second user interactions. 
   
     
     
         15 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
 receive an interaction to initiate an execution of a sequence of user interactions with at least one instance of a plurality of instances of a software application executing within a computing environment, and, in response:
 execute one or more generative machine-learning models trained to generate a data structure configured to generatively present sequences of different information to a user in response to an execution of one or more user interactions with the data structure, wherein the data structure comprises a generated decoy data; 
 generate, based on the presented sequences of different information, one or more classification labels configured to associate with the user each of the presented sequences of different information and the execution of the one or more user interactions; and 
 in response to determining at least a partial completion of the execution of the one or more user interactions with the data structure, store a log of the one or more classification labels, the presented sequences of different information, and the execution of the one or more user interactions. 
   
     
     
         16 . The non-transitory computer-readable medium of  claim 15 , wherein the instructions further cause the one or more processors to execute the one or more generative machine-learning models as further trained to generatively present the sequences of different information in response to the user performing one or more textual command interactions with the data structure. 
     
     
         17 . The non-transitory computer-readable medium of  claim 15 , wherein the generated decoy data comprises one or more honeypots configured to prompt the user to complete the execution of the one or more user interactions with the data structure. 
     
     
         18 . The non-transitory computer-readable medium of  claim 15 , wherein the data structure comprises one or more of a file path, a document content, a linked list, a stack, a queue, a graph, or a breadcrumb. 
     
     
         19 . The non-transitory computer-readable medium of  claim 15 , wherein the instructions further cause the one or more processors to:
 prior to receiving the interaction to initiate the execution of the sequence of user interactions with the at least one instance, train the one or more generative machine-learning models based at least in part on the plurality of instances of the software application executing within the computing environment and a network layout of the computing environment.   
     
     
         20 . The non-transitory computer-readable medium of  claim 15 , wherein the instructions further cause the one or more processors to:
 associate the one or more classification labels to one or more electronic files accessed by the user during the execution of the one or more user interactions with the data structure; and   update the log based at least in part on the one or more electronic files accessed by the user.